The native host reused one fixed boot token across every process. Allocate a fresh nonzero cryptographic nonce in the TypeScript supervisor, require it in the native startup ABI, and reject every response that does not match that launch. Status frames are immutable, failed transports cannot resume, and bench success requires the actual child process to exit cleanly. The report exposes its decimal bootId. The binary wire format stays v1; older host/supervisor pairs need rebuilding together.
This is a prerequisite for #42, building on candidate ownership #49. It does not attest an executable, install/select images, confirm known-good health, or qualify hardware. Slots, current-policy rollback, key maintenance and remaining fault campaigns stay open. Independent FC/RC authority and disabled physical deployment remain.
Validation: 32 actual runtime/diagnostic tests, 296 assertions, zero failures; app/runtime type checks and native Buddy Pickier. Native Buddy bench, docs/roadmap/parity, compilation and five genuinely copied CLI operations outside the checkout pass. The copied clean/fault/record runs use distinct boot IDs; recording, replay and checked inspection pass. Rendered docs: 86 pages, 6,277 local links/fragments and 86 assets, no missing targets. The initial wrong-boot fixture timeout and wrong-cwd diagnostic probe are retained separately; the fixture now isolates Bun startup without changing the two-second response deadline.
Independent Spec and Standards reviews found one obsolete fixed-token sentence, now corrected. Both agents hit account usage limits on the final recheck; the root performed separate final passes over that doc correction and two added native-exit assertions. No production source changed after the independent reviews. Published to origin/main by normal fast-forward as Chris without coauthors after all five exact-head jobs passed in CI 39691526344. All seven reviewed source pins match commit 61ce75d. Refs #2, #9, #42.